Sr. Security Risk Management Analyst

Jobgether; Canada; Remote; CAD 90,000 - 130,000; Full time

Benefits offered by this job

Fully remote from Canada

Exposure to enterprise risk program

Global fintech environment

Collaboration with Security, Eng, Coml

Professional development

Job summary

Jobgether in Canada is seeking a Senior Security Risk Management Analyst to strengthen and scale an enterprise-wide cybersecurity risk program. You will lead end-to-end risk assessments, transform data into actionable insights, and help establish repeatable processes that support risk identification and mitigation.

You will collaborate with security, engineering, and leadership to ensure risks are documented, monitored, and addressed, while contributing to KRIs, risk reporting, and governance

Qualifications

• 5+ years in information security risk management or GRC.
• Hands-on experience conducting risk assessments independently.
• Knowledge of NIST CSF, ISO 27005, PCI DSS, or DoCRA.
• Able to develop scalable, repeatable risk processes.
• Strong analytical and data management skills.
• Experience with KRIs, risk dashboards, and reporting.
• Familiar with GRC platforms such as AuditBoard, Archer, OneTrust, or ServiceNow GRC.
• Proficient in Google Workspace; SQL or Tableau a plus.
• Excellent written communication.
• Strong organizational and problem-solving abilities.
• Ability to work independently in ambiguous environments.
• Fintech or regulated industries experience preferred.

Responsibilities

• Lead end-to-end information security risk assessments.
• Document findings and communicate results to stakeholders.
• Develop risk templates, workflows, and process documentation.
• Maintain risk registers and track mitigation progress.
• Develop KRIs and risk reporting for leadership.
• Collaborate with Vulnerability, App Security, and Blue Team.
• Identify opportunities to automate risk processes.
• Draft and maintain security risk management standards and policies.
• Coordinate with Compliance, Internal Audit, Legal for follow-up actions.
• Support audit readiness and risk-related reporting.
• Continuously evaluate and improve risk program maturity.

Skills

Risk assessments

NIST CSF

ISO 27005

PCI DSS

DoCRA

GRC platforms

AuditBoard

OneTrust

ServiceNow GRC

KRI monitoring

Data analysis

Stakeholder mgmt

SQL

Tableau

Google Workspace

Technical writing

Education

Bachelor’s degree in IT or Cybersecurity or related field

Tools

SQL

Tableau

Google Workspace

Job description

This position is listed on behalf of a partner company, who manages all applications and next steps. Our partner is looking for a Senior Security Risk Management Analyst based in Canada.

As a Senior Security Risk Management Analyst, you will play a key role in strengthening and scaling an enterprise-wide cybersecurity risk management program. You will lead end-to-end security risk assessments, transform complex risk data into actionable insights, and help establish consistent processes that support effective risk identification and mitigation. Working closely with security specialists, engineering teams, and senior leadership, you will ensure that risks are accurately documented, monitored, and addressed. You will also contribute to the development of risk reporting frameworks, Key Risk Indicators (KRIs), and operational procedures that improve visibility and decision-making. This role offers the opportunity to drive process improvements, introduce automation, and support security governance within a complex technology environment. It is an ideal opportunity for an analytical and proactive professional who thrives in a remote, fast-paced, and evolving organization.

Accountabilities

• Conduct end-to-end information security risk assessments, including scoping, data collection, analysis, documentation of findings, and communication of results to relevant stakeholders.
• Apply established risk management methodologies to identify, evaluate, prioritize, and document cybersecurity risks across the organization.
• Support the continuous development and refinement of risk assessment templates, workflows, methodologies, and process documentation to ensure consistency and scalability.
• Maintain accurate risk registers, ensuring that identified risks are properly tracked and progress through mitigation, remediation, or formal risk acceptance processes.
• Develop and maintain Key Risk Indicator (KRI) tracking mechanisms and risk reporting deliverables, translating complex data into clear and actionable insights for senior leadership.
• Collaborate with technical security teams, including Vulnerability Management, Application Security, and Blue Team, to gather relevant information and incorporate operational findings into risk assessments.
• Identify opportunities to streamline, standardize, and automate risk management processes, presenting improvement recommendations to program leadership.
• Contribute to the development, documentation, and maintenance of security risk management standards, policies, procedures, and operational guidance.
• Work closely with cross-functional stakeholders, including Compliance, Internal Audit, Engineering, and Legal, to contextualize risk findings and ensure appropriate follow-up actions.
• Support audit readiness activities, internal reviews, and risk-related reporting requirements in coordination with program leadership.
• Continuously evaluate existing processes and recommend practical improvements that enhance the effectiveness, efficiency, and maturity of the security risk management program.

Requirements

• At least 5 years of professional experience in information security risk management, cybersecurity governance, or Governance, Risk, and Compliance (GRC).
• Demonstrated hands‑on experience conducting and managing security risk assessments independently, including documenting findings and following up on remediation activities.
• Strong working knowledge of established risk management frameworks and methodologies, such as NIST Cybersecurity Framework (NIST CSF), ISO 27005, PCI DSS, or DoCRA.
• Proven ability to develop structured, repeatable, and scalable processes from previously informal or ad hoc operational practices.
• Strong analytical and data management skills, with the ability to collect, clean, interpret, and present complex risk information accurately.
• Experience contributing to Key Risk Indicator (KRI) monitoring, risk dashboards, and reporting deliverables for internal stakeholders and senior management.
• Familiarity with Governance, Risk, and Compliance platforms such as AuditBoard, Archer, OneTrust, or ServiceNow GRC.
• Proficiency in Google Workspace, particularly for documentation, reporting, and collaboration. Knowledge of SQL and/or Tableau is a strong advantage.
• Excellent written communication skills, with the ability to produce clear, structured, accurate, and professional reports and documentation.
• Strong organizational and problem‑solving abilities, with a detail‑oriented approach to risk analysis and process management.
• Ability to work independently, take ownership of responsibilities, and navigate ambiguous situations while remaining aligned with strategic direction.
• Bachelor's degree or higher in Information Technology, Cybersecurity, Business Administration, Engineering, or a related discipline.
• Professional certifications such as CISM, CRISC, or ISO 27001 are considered an advantage.
• Previous experience within fintech, financial services, or other regulated industries is preferred.
• Strong interpersonal and stakeholder management skills, with the ability to collaborate effectively across technical and non‑technical teams.

Benefits

• Fully remote working arrangement, with the flexibility to work from Canada.
• Opportunity to contribute to the development and maturity of an enterprise-scale cybersecurity risk management program.
• Exposure to complex security challenges within a global financial technology environment.
• Opportunity to collaborate with experienced professionals across Security, Engineering, Compliance, Internal Audit, and Legal teams.
• Meaningful ownership of risk management initiatives, with the ability to influence processes, frameworks, and operational improvements.
• Opportunity to work with established cybersecurity and risk management frameworks, tools, and technologies.
• Professional development through exposure to evolving cybersecurity practices, governance standards, and enterprise risk management strategies.
• Inclusive and international working environment that values diverse backgrounds, expertise, and perspectives.
• Merit-based recruitment approach focused on professional capabilities, relevant experience, and skills.